The vulnerability is a missing authorization check in the WebView component of Google Chrome on Android. A crafted HTML page can force the renderer process to bypass the web origin policy, allowing a remote attacker who has already compromised the renderer to access or manipulate resources that should be isolated. This flaw is classified as CWE-862.

Google Chrome for Android versions earlier than 154.0.8037.57 are affected. The issue applies to Android devices running the Chrome browser prior to the listed version.

The CVSS score of 8.4 indicates a high severity impact. The EPSS score of less than 1% shows a very low probability of exploitation in the wild, and the vulnerability is not currently listed in the CISA KEV catalog. The attacker still needs a prior compromise of the renderer process to exploit the missing authorization and bypass the web origin policy, which raises the technical barrier. Overall, the risk remains moderate, but the high CVSS score warrants timely remediation to prevent potential exploitation.